IWM's Use of Cookies

1. What are cookies?

A cookie is a tiny text file that contains some information that may be passed back and forth between your browser (e.g. Internet Explorer, Chrome, Firefox, or Safari) and a computer running a website (typically the site that set the cookie). It does not contain any code and cannot do anything. Most websites set them and many cannot function properly without them. Typically they just contain an identifier so that the server knows that it has seen this visitor before. This means, for example, that someone can log in to a website and stay logged in, they can set their preferences or not be repeatedly shown the same information.

Two major kinds of cookies are:

First Party Cookies - set by the website which is showing in your browser's address bar

Third Party Cookies - these are set by other sites

If any content from somewhere else (such as a YouTube video or an advert) has been embedded into another page, that third-party content might set a cookie of its own. Browsers know the difference between first- and third-party cookies and let you treat them differently.

Cookies also vary in their duration. "Session cookies" last only for the length of your visit, whilst others might last for days or months so that a site will recognise you next time you visit.

2. What do they mean for me?

On our websites, cookies mean a better experience, including enabling a number of functions that would otherwise not be possible. But there are things you should understand about them.

The web has no built-in way of remembering what you've done, which is good and bad. It's good because it can make it more robust and functional, and it can make it more private. It's bad because we need other ways to remember what just happened, for instance if you filled in part of a form and now need to complete a second page, or if you have logged in and want to stay logged in after the login confirmation page. Cookies are a core part of the answer to this problem because they let things that happen on one page be connected to things that happen on another page - they give websites some sort of memory to make sense of your visit.

What this means for you is that cookies can be used to associate you with your actions. They don't by themselves know who you are because a cookie is only tied to a browser, but if you have told a website who you are that information could be put into a cookie, or held in a database and referred to by a cookie.

Like a piece of paper, a cookie could have all sorts of things written in it and so could be used for passing harmless information to harmless people, or not. If a website owner is of good faith then the cookies they set should not mean anything bad for you.

IWM undertakes to use first party cookies carefully and to be conscientious about the third-party services we incorporate into our site so that you can be confident about the cookies that they set. However whilst we have a high degree of control over the first-party cookies we set, third-party ones are by their nature less controllable by us. The only way for us to avoid third-party cookies, however, is not to use any third-party elements on our website. Please read "Why do you not operate an 'opt-in' arrangement?” for our rationale for choosing to show such content by default and to let our users decide whether to refuse third party cookies.

3. What cookies might be set on IWM sites?

Our main website - www.iwm.org.uk - sets a number of first-party cookies that are built into our website software, Drupal. They are intended to improve the experience for visitors and to improve the performance of our web servers. The data they contain are uninformative numbers.

We also set some other cookies to understand how people arrived at our site and what they did when they got there. This data is anonymous (even if you've logged in) and we cannot see what individuals do, only understand trends. We see this as vital for improving what we do for you, as well as being the basis for telling government and taxpayers how we are performing. We don't put your name or personal information in any cookies.

On parts of our site we also use third-party services that can set their own cookies. For example, the AddThis button and videos from Vimeo each set tracking cookies. The websites of these services explain that they are used when you interact with them, so that they know whether a person has, for example, used that service on more than one website. However it is important to remember that IWM does not control how the cookies are used and it is possible (although perhaps unlikely) that their use might be changed by the third party without our knowledge. We have chosen these services in the belief that their cookies are not intrusive and we know that we cannot offer those services at all without them attempting to set these cookies. They can, however, be controlled by using your browser settings to decline third-party cookies. Some third parties (AddThis) offer an opt-out mechanism. You can find out more about the cookies set by various services at http://cookiecert.com.w3snoop.com/ (it also rates our sites).

We maintain a list of cookies that you may find on our main website, with explanation of what they do. We will make our best efforts to keep this up-to-date and accurate but it may not be exhaustive:

Our other websites (including IWM Shop, IWM Prints, Image Sales and Licensing, Film Sales, ticket booking and our blogs) also use Google Analytics. Some of them also use their own cookies which are essential for the functionality of that site: searching, logging in, or making a purchase. Because of this, if you disable all cookies using your browser you will not be able to perform these actions properly. Some of them are run by other companies so we may not always be aware of changes they make. One of these, the Print Sales site, has its own set of cookie controls. We maintain another list of cookies that can be found on these other websites, with explanation of what they do:

4. Google DoubleClick and Personalised Advertising

We use the Google DoubleClick service to plan our online advertising campaigns and to assess their impact. Information collected by the service is also used to provide you with personalised banner advertising for products or services that may interest you.

We do this by collecting information from the IWM site via the use of cookies provided by Google DoubleClick and managed by our marketing partner AKA. The cookies collect information about the websites you visit and the advertisements you interact with, along with your computer’s IP address. They do not collect any personal information that may identify you.

Here’s further information on how to opt out of receiving further personalised advertisements. You may also opt out of receiving further personalised advertisements in the future by clicking on the bottom right hand corner of any advertisement you receive and following the instructions. Visit the Google DoubleClick website for further information on this service.

You can turn off cookies set by individual sites ("domains") and you can usually also elect to be prompted when a cookie is being set. If instead you choose to turn all cookies off, however, it will not be possible for you to log in to any of our websites and some other functions may stop working. You can also simply set your browser to accept cookies but clear them at the end of every session.

As noted above, on our e-commerce websites (IWM Shop, Print Sales, Image Licensing, Film Sales and Ticket booking) you should not turn off cookies entirely if you wish to be able to log in or make a purchase. Instead, you might set your browser to prompt you whenever a cookie is being set so that you approve them individually. In the case of the IWM Prints you should use the options on that site.

Some websites build into the site a switch to turn off cookies on its site. IWM does not do this for two main reasons.

1) Reliability

Turning off cookies on a website is not always a simple matter, and whilst it is relatively easy for us to avoid setting some "first party" cookies, it is the third-party ones that are potentially more intrusive but which are also much more likely to slip through the net. Every time we include content from somewhere else (for instance YouTube videos, Flickr photos, Google maps, or a survey) those other sites might set cookies. Even if at the time we embed that content the content provider does not set cookies, because the content always comes from elsewhere it is possible that this could change without us being aware of it, and new cookies could be set. We could choose to never show any third party content to people that don't want any cookies set, or we could vet it to only use content providers that don't set cookies, but there remains a risk that this will change without our knowledge. Instead we have decided to regularly audit the use of cookies by those external sites listed above, recognising that this is not infallible. Rather than us offering the illusion of a control that we have built, or a compromised experience on our site, we believe it is more reliable for you to control cookies via your browser, meaning that you can be guaranteed that your browser will not accept any cookies of the type that you determine - first-party, third-party or both.

2) Consistency

Those of our users who don't wish for cookies (first part or third party) to be set by IWM or the third party services that we use to enrich our site (YouTube, Vimeo etc.) are likely also to want to prevent these cookies being set elsewhere. Therefore even if the IWM site did have a switch of its own, unless these visitors change their browser settings (adding in any exceptions they wish to make) then they will continue to have cookies set by other websites - because many other sites (especially outside the UK) will not have such an option. The best solution for web users, then, is to use the browser to prevent unwanted cookies from being set.

It is worth noting that the third-party marketing/advertising cookies that many people find most concerning are also regulated, and a number of industry mechanisms exist for controlling which of companies you permit to set cookies in your browser. This can help you to target very specifically which cookies you will and will not accept.

6. Why do you not operate an "opt-in" arrangement?

We do. Browser controls provide an opt-in mechanism, but they can only really be thought of like that once people understand what cookies are and how to manage them, which is what this page aims to achieve.

The Information Commissioner's Office of the UK government states that at the moment people don't know enough about cookies to make an informed choice, and an uninformed choice is no choice at all. IWM agrees with this, so we know we can't just treat browser controls an opt-in mechanism on their own and assume that they are controlling cookies as our users wish, unless we have first of all done our best to explain to you what we do and what control you have over it. Whilst this means that cookies are likely to be set before some visitors see this notice, we do our best to bring it to their attention as soon as possible to help people to make an informed choice. But there are other reasons why we don't operate an opt-in arrangement on the IWM site itself.

Firstly, as we explained above, it would be very difficult to guarantee that third-party cookies would not slip through the net if we were to offer a "switch" of our own. The same applies to any opt-in arrangement. The only way that we could guarantee that a visitor who had not opted in could never have a third-party cookie set would be to never embed any third party content for them, even if we believed it was 'clean'. Only browser controls can break this deadlock and allow you complete, granular control over what cookies you are happy to accept and what you reject.

Secondly, many websites (including IWM's) set cookies when you first access the site. These are intended to help organisations understand how people find websites - what sites they have come from and what keywords they use in search engines to find what they need. The cookies used by IWM in this way contain statistical information only and cannot be used to identify or target individuals. And since it is only when a user requests files from a server after a cookie has been set that that cookie will be passed back to the server, our first-party statistical cookies will actually do anything (that is, pass some the anonymous information itemised above back to a server) on your second and subsequent views of our pages. We believe that our cookies are not intrusive and hope that enough of our visitors are happy for us to use them that we can continue to learn about how people use our website. However, we naturally understand that you may prefer not to accept these cookies. By changing your browser settings you can ensure they are not set at all.